Privacy Policy

Effective: 1 October 2026

This Privacy Policy explains how E. F. COMPUTERS j.d.o.o. processes personal data in connection with the AgroBooker platform (https://agrobooker.app), in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Croatian Act on the Implementation of the GDPR (Official Gazette NN 42/18).

1. Who we are

Controller: E. F. COMPUTERS j.d.o.o. Donji Srbani 137, 52474 Brtonigla, Croatia OIB (tax ID): 71347174941 Email: info@agrobooker.app

We have not appointed a data protection officer as we are not legally required to. For any privacy question, write to info@agrobooker.app.

2. What AgroBooker is and our two roles

AgroBooker is a business-to-business (B2B) platform that wineries and agritourism businesses ("Companies") use to manage bookings for tastings and visits, loyalty programmes (wine clubs), shipments and messages with their guests.

• As a controller we process data about platform users (Company staff, agencies), visitors to our website and people who contact us through the contact form. This Policy covers that processing.
• As a processor we process the data of guests and club members on behalf of the Company they booked with or are a member of. For that data, the Company is the controller — see section 3.

3. If you booked a visit or are a wine club member

When you book a tasting or visit through an AgroBooker booking form, or you are a member of a winery's club, the controller of your data is that winery (the Company). The winery decides what data is collected, why, and for how long. AgroBooker processes that data only on the winery's instructions, under a data processing agreement (Art. 28 GDPR).

• The winery's name and contact details are shown on the booking form and in the booking emails you receive.
• Please send requests for access, rectification, erasure or objection directly to the winery.
• If you contact us instead, we will forward your request to the winery without undue delay and let you know.
• Optional emails (e.g. a thank-you after your visit or a review request) contain an unsubscribe link you can use at any time. You will still receive messages about your bookings.

4. What data we process, why, and on what legal basis

Company staff user accounts

• Data: name, email address, password (stored only as a cryptographic hash), interface language, role and permissions within the Company, additional notification email addresses, login and session data (IP address, browser/device, last activity time), API access tokens, the browser's push notification subscription and the browser/device name, in-app notifications.
• Purpose: creating and managing accounts, providing the service, sending notifications about bookings and messages, user support.
• Legal basis: performance of our contract with the Company (Art. 6(1)(b)) and our legitimate interest in enabling our customers' staff to use the service (Art. 6(1)(f)).

Agencies

• Data: agency name, contact person name (if provided), email, phone, password (as a hash), notes, session data, and bookings made by the agency.
• Purpose and basis: managing the agency account and passing bookings to Companies — performance of a contract (Art. 6(1)(b)).

Security and abuse prevention

• Data: IP address, browser data, login attempts, technical logs.
• Purpose: protecting accounts (e.g. limiting login attempts), detecting and fixing errors.
• Legal basis: legitimate interest in service security (Art. 6(1)(f)).

When a new password is set, we check whether it has appeared in known data breaches using the "Have I Been Pwned" service. Only the first five characters of the password's SHA-1 hash are sent (k-anonymity); neither your password nor your email address leaves our system.

Website contact form

• Data: name, email address, winery name (optional), message content.
• Purpose: answering your enquiry and, where relevant, preparing an offer. We also send a confirmation of receipt to your address.
• Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b)) and legitimate interest in answering enquiries (Art. 6(1)(f)).
• Contact form data is not stored in the platform database; it is delivered by email to info@agrobooker.app.

Visiting the website

• Data: IP address, browser type, access time, strictly necessary cookies (see the Cookie Notice).
• Purpose and basis: displaying the site and security — legitimate interest (Art. 6(1)(f)).
• We do not use analytics, advertising or tracking cookies.

Business and accounting records

• Data: customer contact persons, offers, contracts, invoices.
• Legal basis: legal obligation (Art. 6(1)(c)) — in particular accounting and tax legislation.

We do not make automated decisions or create profiles that produce legal effects for you.

5. How long we keep data

6. Recipients and processors

We do not sell your data. We share it only with service providers that help us run the platform, under data processing agreements:

We may also disclose data to competent authorities where required by law.

7. Transfers outside the EU/EEA

We store data primarily in the European Union. Where a provider processes or accesses data from a third country, the transfer is based on:

• a European Commission adequacy decision (e.g. the United Kingdom; US companies certified under the EU–US Data Privacy Framework), or
• the European Commission's Standard Contractual Clauses (Art. 46 GDPR) with supplementary safeguards.

You can request a copy of the relevant safeguards at info@agrobooker.app.

8. Your rights

Under Articles 15–22 GDPR you have the right to:

• access your data and receive a copy,
• rectification of inaccurate data,
• erasure ("right to be forgotten"),
• restriction of processing,
• data portability for data you provided to us,
• object to processing based on legitimate interest,
• withdraw consent at any time where processing is based on consent (without affecting the lawfulness of earlier processing).

Send requests to info@agrobooker.app. We will respond without undue delay and at the latest within one month (extendable by two further months for complex requests, in which case we will tell you). We may ask for information to verify your identity. Staff users can also delete their own account in their profile settings.

9. Right to lodge a complaint

If you believe the processing of your data infringes the law, you may lodge a complaint with the supervisory authority:

Croatian Personal Data Protection Agency (AZOP) Selska cesta 136, 10000 Zagreb, Croatia azop@azop.hr · www.azop.hr

We would appreciate the chance to resolve the issue first, so please feel free to contact us.

10. Security

We apply appropriate technical and organisational measures: encrypted connections (HTTPS/TLS), passwords stored as bcrypt hashes, checks against compromised passwords, separated access to each Company's data with roles and permissions, rate limiting, secure cookies, and servers located in the EU.

11. Children

The platform is intended for business users and is not directed at children. We do not knowingly collect data from persons under 16.

12. Changes

We may update this Policy from time to time. The current version is always published at https://agrobooker.app, and we inform account holders of material changes by email or in the app.

This is a translation. In case of any discrepancy between the Croatian and English versions, the Croatian version prevails.